3.8.1 The problem at issue

Material used in medical and health research often consists of human biological material (including bio banks), data files (including personal data registers), case notes, analyses, memos, draft manuscripts and the like. The research material is the basis for the research results. To enable a future check of whether the research results are correct and/or arrived at in a sound manner, it is often a prerequisite that the underlying research material can be examined.

In this context there can be question of, and if so, how and for how long, researchers must retain the research material (retention obligation).

Another problem is related to the retention right – i.e. the researcher’s right to manage the research material: May researchers delete research material whenever they want to, or keep the research material for as long as they wish and do with it as they themselves find serviceable?

3.8.2 The retention obligation

According to good scientific practice, raw material shall basically be retained in order to ensure checks. The period of retention according to scientific practice is difficult to state. For example, this norm is

specified in the Regulations on Clinical Testing of Medicines, in which section 5-3 (2) and (3) state that it must be ensured that source data are available at the place of testing for at least fifteen years from the date of the final test report. The Nylenna Committee has also recommended the enactment of a retention obligation for all raw material for ten years after the completion of the research project (NOU 2005:1). In addition, there are relevant rules on this in the Bio Bank Act, the Personal Data Act and the Personal Health Data Filing System Act, which the Commission does not find reason to comment on in detail. There are also rules for the retention and processing of documents in the health service in, i.a., the Specialist Health Service Act, the Health Personnel Act and the Patient Case Notes Regulations. The employer may also have established internal instructions on this. Moreover, documents prepared by employed researchers at public institutions, as for example a public hospital, even if it is not practiced like that currently, may be subject to more general rules on the retention and processing of documents as for example the Archives Act. The retention obligation must of course take appropriate account of the requirements made to the processing and storing of person-identifiable information.

As an example may also be mentioned that the Research Council of Norway in its standard form contract provides that the research material shall be stored in line with good scientific practice. The prevailing contractual condition “Standard form contracts and granting letters – R&D” state among other things:

“Unless otherwise provided by the body authorized to decide the use of the data, copies of all research generated data, including necessary documentation, shall be transferred to the Norwegian Social Science Data Services. Such transfer shall take place as soon as possible, and no later than two years after the conclusion of the period to which the project grants apply. The data that are to be comprised by this must be agreed specifically with the Research Council. … The person responsible for the project is responsible for following relevant standards of quality, statutes and other public regulations. Where test persons/patients/clients are included in research projects, a recommendation by the regional committee for Medical Research Ethics according to the prevailing rules relating to the obligation to submit is required. The project responsible person is responsible for the recommendation being complied with. … The project responsible person shall file the final test report in an adequate way for a minimum of ten years after the completion of the project. The project responsible person is under a duty to ensure that the data are stored in such a way that they will also be taken care of and be available should the project responsible person cease to have such a responsibility. The project responsible person is obligated to follow recognized quality norms when collecting and filing data. Any breach of obligations relating to the reporting and filing will be considered as a fundamental breach and thus give the Research Council reason to cancel the contract, cf section 12.2. …”

Since 1995, the Research Council has had an agreement with the Norwegian Social Science Data Services on the filing of research data relating to medical and health research. For the year 2000 this included that “The project responsible person shall file the final test report and project data in an adequate way for a minimum of ten years after the conclusion of the project. The project responsible person is under a duty to

ensure that the data are kept in such a way that they will also be taken care of and be available if the project responsible person is dissolved” (read: the institution).

Right of retention and management

As regards the question of the right of management in more general terms, reference is made to the fact that research material, and in particular the use and retention of human biological material and personal data, collected by or under the auspices of a research institution, will, as the obvious main rule, be subject to the institution’s overall responsibility, and thus also to the institution’s right of management. This type of sensitive material is not the private property of an employed researcher.25 This must now be fairly clear, although a district court decision from 199926 may be cited in support of the opposite solution.27